Commit 98a23609 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Linus Torvalds
Browse files

maccess: always use strict semantics for probe_kernel_read 



Except for historical confusion in the kprobes/uprobes and bpf tracers,
which has been fixed now, there is no good reason to ever allow user
memory accesses from probe_kernel_read.  Switch probe_kernel_read to only
read from kernel memory.

[akpm@linux-foundation.org: update it for "mm, dump_page(): do not crash with invalid mapping pointer"]

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20200521152301.2587579-17-hch@lst.de


Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7676fbf2

arch/parisc/lib/memcpy.c

+1 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ void * memcpy(void * dst,const void *src, size_t count) 
EXPORT_SYMBOL(raw_copy_in_user);

EXPORT_SYMBOL(memcpy);



bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict)

bool probe_kernel_read_allowed(const void *unsafe_src, size_t size)

{

	if ((unsigned long)unsafe_src < PAGE_SIZE)

		return false;

arch/um/kernel/maccess.c

+1 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
#include <linux/kernel.h>

#include <os.h>



bool probe_kernel_read_allowed(const void *src, size_t size, bool strict)

bool probe_kernel_read_allowed(const void *src, size_t size)

{

	void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);

arch/x86/mm/maccess.c

+2 −7
Original line number Diff line number Diff line
@@ -9,13 +9,10 @@ static __always_inline u64 canonical_address(u64 vaddr, u8 vaddr_bits) 
	return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);

}



bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict)

bool probe_kernel_read_allowed(const void *unsafe_src, size_t size)

{

	unsigned long vaddr = (unsigned long)unsafe_src;



	if (!strict)

		return true;



	/*

	 * Range covering the highest possible canonical userspace address

	 * as well as non-canonical address range. For the canonical range
@@ -25,10 +22,8 @@ bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict) 
	       canonical_address(vaddr, boot_cpu_data.x86_virt_bits) == vaddr;

}

#else

bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict)

bool probe_kernel_read_allowed(const void *unsafe_src, size_t size)

{

	if (!strict)

		return true;

	return (unsigned long)unsafe_src >= TASK_SIZE_MAX;

}

#endif

include/linux/uaccess.h

+1 −3
Original line number Diff line number Diff line
@@ -301,11 +301,9 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src, 
	return 0;

}



bool probe_kernel_read_allowed(const void *unsafe_src, size_t size,

		bool strict);

bool probe_kernel_read_allowed(const void *unsafe_src, size_t size);



extern long probe_kernel_read(void *dst, const void *src, size_t size);

extern long probe_kernel_read_strict(void *dst, const void *src, size_t size);

extern long probe_user_read(void *dst, const void __user *src, size_t size);



extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);

kernel/trace/bpf_trace.c

+1 −1
Original line number Diff line number Diff line
@@ -196,7 +196,7 @@ bpf_probe_read_kernel_common(void *dst, u32 size, const void *unsafe_ptr) 


	if (unlikely(ret < 0))

		goto fail;

	ret = probe_kernel_read_strict(dst, unsafe_ptr, size);

	ret = probe_kernel_read(dst, unsafe_ptr, size);

	if (unlikely(ret < 0))

		goto fail;

	return ret;

CRA Git | Maintained and supported by SUSTech CRA and CCSE